Canadian sanctions – Compliance program implementation

Sanctions are a foreign policy tool used to address international peace and security concerns, gross violations of human rights, and significant foreign corruption. They form part of a comprehensive foreign policy approach involving political dialogue, engagement, and programming. All individuals, businesses, entities, and other stakeholders in Canada, as well as Canadians abroad, must comply with Canadian sanctions legislation and associated regulations. Contravening sanctions is a criminal offence. All suspected sanctions violations must be reported to the RCMP.

Sanctions compliance is complex and challenging due to the wide range of activities subject to sanctions regulations and the constant updating and additions to Canada’s sanctions regime. New sanctions regulations may be added, or existing regulations may be amended to include new measures or additional activities subject to sanctions. Listings or designations are also frequently updated, with new additions to the Canadian Consolidated Autonomous Sanctions List or the UN Security Council Consolidated List. The ever-evolving nature of sanctions requires persons (individuals and entities) in Canada and Canadian persons abroad to continuously monitor and update their compliance programs.

This guide is designed to help stakeholders understand sanctions compliance, develop their own sanctions compliance programs, and to manage sanctions risks as effectively as possible. This means undertaking rigorous due diligence and implementing robust internal policies, procedures, and controls that are tailored to the specific risks faced by the individual or entity.

On this page

• Glossary
• Basics and legislation
• Sanctions compliance issues
• Compliance program
  • Senior management commitment
  • Risk assessment
  • Internal controls, policies and procedures
  • Testing and auditing
  • Training
• Due diligence best practices
• Risk mitigation – Case studies
• Contact us
• Additional resources, information and guidance

Glossary

Canadian

A person who is a citizen within the meaning of the Citizenship Act or a body corporate incorporated or continued by or under the laws of Canada or of a province.

Consolidated list

Global Affairs Canada maintains the Consolidated Canadian Autonomous Sanctions List of listed persons, available on the Canadian Sanctions website. Persons in Canada and Canadian persons abroad must also adhere to United Nations (UN) sanctions and can consult the UN Security Council Consolidated List.

Entity

A body corporate, trust, partnership, fund, an unincorporated association or organization or a foreign state.

Person

A person means an individual or entity. Persons listed under Canadian sanctions laws are subject to targeted dealings prohibitions. Listed individuals are also inadmissible to Canada under the Immigration and Refugee Protection Act (IRPA). See Canadian Sanctions for further information.

Property

Any type of property, whether real or personal or immovable or movable, or tangible or intangible or corporeal or incorporeal, and includes money, funds, currency, digital assets and virtual currency.

Sanctions Bureau

The Sanctions Bureau is the Government of Canada’s sanctions regulator. The Sanctions Bureau sits within the Department of Global Affairs Canada.

Sanctions permit or certificate

A permit, provided at the discretion of the Minister of Foreign Affairs, enables a person to undertake an activity that would otherwise be prohibited by Canadian sanctions legislation.

A certificate must be requested from the UN by the Minister for an activity that would otherwise be prohibited by UN sanctions legislation.

Technical data/support

Includes blueprints, technical drawings, photographic imagery, computer software, models, formulas, engineering designs and specifications, technical and operating manuals and any technical information or know-how.

Basics and legislation

Understanding sanctions is critical to the development of a sanctions compliance program. Consult Canadian sanctions – Essential information for a primer on Canada’s sanctions regime.

It is important to note that reporting entities under the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) must also ensure compliance with obligations under The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). For more information see:

• Guidance and resources for businesses
• Report suspected sanctions evasion
• Reporting listed person or entity property

Sanctions compliance issues

The following are some of the common weaknesses or deficiencies that lead to sanctions violations:

Lack of awareness of sanctions obligations

Many individuals and entities that engage internationally fail to consider sanctions obligations and screening as part of their usual due diligence processes. In most instances of imports or exports detained by Canada Border Services Agency (CBSA), the importer or exporter in question failed to realize that they were violating sanctions laws. Global Affairs Canada, in conjunction with the Royal Canadian Mounted Police (RCMP) and CBSA, has undertaken robust outreach with stakeholders across Canada to help stakeholders understand their obligations and to support stakeholders in navigating Canada’s sanctions regime.

Not staying up to date on sanctions

Canadian sanctions are constantly changing, with regular updates and additions. Individuals and entities must ensure that they look at the latest updates every time they screen for sanctions compliance. Consult the latest announcements and subscribe to the Global Affairs Canada Sanctions Bureau distribution list to keep up to date with sanctions updates, including changes to legislation or regulations, and website updates.

Misinterpreting or misunderstanding Canada’s sanctions regime

It is the obligation of every individual and entity in Canada and Canadian individuals and entities operating abroad to comply with Canada’s sanctions legislation. Global Affairs Canada can assist stakeholders in navigating Canada’s sanctions regime but cannot provide legal advice. If unclear as to whether a proposed activity is permitted under sanctions legislation, consult private legal counsel. Global Affairs Canada is taking steps to provide more clarity to stakeholders, including updating and adding website content and undertaking a review of Canada’s sanctions regulations.

Lack of a formal sanctions compliance program

Entities that approach sanctions compliance on an ad hoc basis are more likely to be unprepared when confronted with potentially problematic situations. Having a robust sanctions compliance program in place, with properly trained employees, will minimize compliance risks.

Improper due diligence

Sanctions due diligence and screening is a core function of a sanctions compliance program. Conducting due diligence with respect to, among others, customers, partners, supply chains, intermediaries is a core component of a sanctions compliance program.

Compliance program

Establishing and implementing a documented and comprehensive compliance program is recommended in order for persons to meet their obligations under Canada’s sanctions legislation and the associated regulations. Sanctions measures and the associated risks are constantly evolving; therefore, it is essential to continuously monitor and reassess compliance strategies.

Sanctions compliance programs play a central role in sanctions compliance at the organizational level. A sanctions compliance program should typically include the following elements:

• Senior management commitment
• Risk assessment
• Internal control, policies and procedures
• Testing and auditing
• Training

Senior management commitment

Senior management commitment and support are essential in ensuring the sanctions compliance program receives adequate resources and becomes fully integrated into the entity’s daily operations. This, in turn, will help legitimize the program, empower personnel and foster a culture of compliance throughout the entity.

The following are some examples for best practices in establishing a sanctions compliance program with senior management commitment:

1. The sanction compliance program has been reviewed and endorsed by senior management and adherence to the program is actively and regularly promoted throughout the entity.
2. Senior management ensures compliance units have the autonomy to enforce policies, with direct reporting lines between the compliance unit and senior management, including routine and periodic meetings.
3. Senior management remains committed to providing compliance units and other implicated parts of the entity with sufficient resources, such as human capital, expertise, technology, training and other necessary support, aligned with the entity’s operations, markets, and risk profile.
   1. This may be accomplished through the appointment of a sanctions compliance officer and can be measured by the quality and experience of personnel dedicated to sanctions compliance, i.e. the level of knowledge of Canada’s sanctions regime and the ability to assess the entity’s activities against sanctions obligations.
4. Senior management actively cultivates a strong compliance culture across the entity, ensuring adherence to sanctions is deeply ingrained in the entity’s values and practices.
   1. This may be measured by the ability of the compliance unit to oversee the actions of the entire entity, senior management communication of the potential repercussions of non-compliance, and the ability of personnel to report sanctions related issues to senior management without fear of reprisal.
5. Recognizing the seriousness of compliance breaches, senior management implements measures to mitigate risks, resolve deficiencies, and prevent recurrence through strategic solutions.

Risk assessment

Risks in sanctions compliance are potential threats or vulnerabilities that, if ignored or not properly handled, can lead to violations of Canada’s sanctions regime with criminal penalties, in addition to harming an entity’s reputation and business. Taking a risk-based approach to sanctions compliance and focusing resources and efforts on areas where the potential for violations is highest will help entities prioritize and manage sanctions risks linked to its activities. 

A risk-based approach may include the following:

• Perform a risk assessment exercise to assess the risk of a sanctions offence linked to the proposed activity, looking at potential risks related to, among other things, customers, products, services, geographic locations, and supply chains.
• Upon completion of the risk assessment exercise, prioritize risks based on their likelihood of occurring which may include the country implicated in the activity, the sector, or any identified links to listed individuals or entities.
• Implement tailored controls and allocate resources as needed to mitigate any potential sanctions circumvention.
  1. This may include enhanced due diligence for transactions in high-risk jurisdictions (i.e. where Canada has sanctions regimes in place) or sectors subject to sanctions (i.e. aerospace and defense, marine).
  2. This should also include training for employees as those unaware of sanctions obligations are more likely to make mistakes.
• Continue to monitor and review controls and training programs to assess their effectiveness and to ensure changes to Canada’s sanctions regime are incorporated as soon as they are implemented.
• Document the risk assessment process for specific activities or transactions, detailing how the assessment was completed and the factors considered.
  1. This will be important to show to law enforcement in the event of an alleged sanctions violation.

Internal controls, policies and procedures

Effective sanctions compliance requires internal controls, including policies and procedures with respect to the entity’s sanctions compliance program. This is more than screening a particular activity or transaction and speaks to broader internal policies and procedures to identify, report, record and minimize the risks identified during the risk assessment process.

Examples of internal, written controls may include:

• Policies and procedures, specific to the entity’s operations, outlining the sanctions compliance program.
  • These policies and procedures should reflect the entity’s day to day operations and be easy to follow.
• Policies and procedures that address the development and results of the risk assessment, including how to escalate and report any activity or transaction that may violate sanctions.
• Record keeping and retention of sanctions risk assessments and actions taken to both mitigate sanctions risk and address any weaknesses in the entity’s sanctions compliance program, policies, or procedures.
• Clear communication of the internal policies and procedures to employees, with a focus on those in the compliance unit and any business units operating at higher risk, such as sales or new client acquisition.
• Processes for integrating sanctions compliance screening into the daily operations of the entity.

Testing and auditing

The entity should ensure regular testing and auditing of its compliance program and report the results to senior management. The testing and auditing interval will likely depend on the size, complexity, and characteristics (such as, sector, customer base) of the entity. It can be a function of the sanctions compliance unit, or it can fall under broader corporate risk reviews.

The goal of testing and auditing is to identify any weaknesses or deficiencies in the sanctions compliance program, and to modify or enhance the program as needed. This may include revising the sanctions compliance program to respond to changes in Canada’s sanctions regime, a new product/service offering by the entity, or any other factor that alters or changes the entity’s activities.

Additionally, an entity could enhance its oversight by having its sanctions compliance program audited by an independent party, providing an objective assessment of its policies, procedures, and overall effectiveness.

Training

The entity should commit to a comprehensive sanctions training program. The program may include:

• Information and instruction to all employees, as appropriate, on sanctions compliance obligations.
• Additional information and instruction for relevant stakeholders on compliance obligations, such as clients, suppliers, and partners.
  1. The entity should determine the frequency of this instruction based on a range of factors which could include its size, complexity, client/supplier turnover and risk profile.
• The training program should be tailored to address the operating circumstances of the entity, i.e. countries and sectors in which it operates, and cover Canada’s sanctions legislation and relevant regulations.
• Upon uncovering a deficiency related to sanctions compliance, the entity should immediately provide training to relevant personnel or stakeholders.

Due diligence best practices

The following are some due diligence steps that can be taken by individuals and entities to assess whether an activity may indicate a risk of sanctions evasion:

1. Subscribe to the Global Affairs Canada Sanctions Bureau distribution list to keep up to date with sanctions updates, including changes to legislation or regulations, and website updates.
2. Verify if any client you plan to deal with is listed under any of the following sanctions lists:
   1. Consolidated Canadian Autonomous Sanctions List
   2. Consolidated UN sanctions list
3. Consult the sanctions legislation and associated regulations to determine the applicable sanctions measures against the country of the client you plan on dealing with or against a sanctioned client.
4. Determine if the client you plan to deal with has any direct or indirect association with individuals or entities sanctioned by Canada.
   1. This includes any indirect dealings with a listed individual or entity through, among others, associates, family members, legal representatives, subsidiaries of a company, parent/holding company, and an intermediary bank.
5. Determine if the activity involves prohibited goods or prohibited services under the regulations.
6. Consult Due diligence - Red flags for common red flags for sanctions evasion.
7. Document your assessment process, decisions or legal advice.
   1. In case of any sanctions violations, you will be able to demonstrate reasonable due diligence was exercised.
8. Report any suspicious transaction or activity leading to sanctions violations or evasion.

Note: If unsure if a transaction or activity is permissible according to Canada’s sanctions legislation and associated regulations, seek legal advice.

Risk mitigation – Case studies

The following case studies provide examples of reasonable due diligence. It is important to note that reasonable due diligence is situational dependent, and these examples are illustrative only. The level of due diligence required will vary by entity and context. Factors that may impact the level of due diligence required could include the size and nature of an entity, the geographic locations involved, the goods or services involved, the complexity of the transaction or activity, and the specific sanctions regulations that are in place. Any real or potential sanctions violation identified in the course of undertaking due diligence should be reported to the RCMP.

Case study #1: Making payments to individuals or entities

ABC Inc. is a Canadian retail business that sells fishing equipment. ABC Inc. purchased fishing lures from DEF Enterprise, a new foreign supplier. ABC Inc. must consider both the import of the fishing lures and the payment of the invoice for consistency with Canadian law, including looking at any import prohibitions or any financial transaction prohibitions linked to the purchase, such as connections to any individual or entity on the Canadian Consolidated Autonomous Sanctions List or the UN Security Council Consolidated List.

ABC Inc. takes the following steps in accordance with its sanctions compliance program to avoid contravening sanctions:

• ABC Inc. reviews Canada’s sanctions regulations for any relevant restrictions or prohibitions related to the country DEF Enterprise operates in.
  • This includes checking for updates on sanctions regulations and the sanctions lists.
• ABC Inc. reviews the regulations in place related to the country DEF Enterprise operates in to determine if importing fishing lures is permitted under the regulations.
  • Upon a review of the relevant regulations and schedules of import prohibitions, ABC Inc. determines that the import of fishing lures from the country DEF Enterprise operates in is not prohibited.
• Next, ABC Inc. compares DEF Enterprise against the Canadian Consolidated Autonomous Sanctions List available on the Global Affairs Canada website as well as the UN Security Council Consolidated List.
  • This preliminary step ensures that the recipient of the funds is not a listed entity.

• ABC Inc. is aware that screening DEF Enterprise also includes knowing who is behind the entity. It explains its obligation to comply with Canada’s sanctions laws and requests more information from DEF Enterprise, such as its organizational structure, including its ownership and senior leadership.
  • DEF Enterprise leadership and owners, as well as any intermediate holding companies or ultimate beneficial owners are also checked against Canadian Consolidated Autonomous Sanctions List and the UN Security Council Consolidated List.
  • This helps determine if the supplier is not linked to any designated persons or entities.

• Knowing the details of DEF Enterprise, such as the country it operates in, and having reviewed the regulations and screened against both sanctions lists, ABC Inc. evaluates the overall risk associated with paying the invoice.
• If any initial checks or additional information, such as with respect to DEF Enterprise’s financial institution, raise concerns about potential links to listed individuals or entities, ABC Inc. is prepared to hold the payment temporarily and seek further clarification or advice before proceeding.
• ABC Inc. is unsure if payment of the invoice will trigger a sanctions violation and obtains independent legal advice which provides guidance on the necessary steps to verify that the payment complies with Canadian sanctions laws.
• ABC Inc. maintains detailed records of the steps taken, including the screening process, any legal advice obtained, and communications with DEF Enterprise. This documentation serves as proof of their due diligence.

After conducting the screening and obtaining independent legal advice, ABC Inc. confirms that DEF Enterprise is incorporated in a sanctioned country but that it is not associated with any listed persons. It therefore concludes that paying the invoice will not constitute a violation of Canada’s sanctions.

Case study #2: Exporting goods

JKL Canada is a Canadian company which exports carbon capture equipment in the clean tech sector. The company must comply with Canadian sanctions laws and should take reasonable precautions and exercise due diligence when making sales or exporting goods abroad. This includes being aware of any export prohibitions in place in certain countries.

JKL Canada plans to export a shipment of thermal oxidizers to MNO Company, a new customer based in Country Y, which is subject to export sanctions. The company needs to ensure that this shipment does not contravene Canadian sanctions laws.

JKL Canada takes the following steps in accordance with its sanctions compliance program to avoid contravening sanctions:

• The company reviews relevant sanctions regulations related to Country Y.
  • This includes looking at specific prohibited goods and any potential dual use applications of its product.
• The company compares MNO Company against the Canadian Consolidated Autonomous Sanctions List available on the Global Affairs Canada website as well as the UN Security Council Consolidated List.
  • This confirms that MNO Company is not a listed entity.
• The company communicates Canada’s sanctions obligations to MNO Company and requests additional details from MNO Company, including its registration information and ownership and management structure to see whether any related individuals or entities are on the sanctions lists.
  • The company evaluates the risk associated with the transaction by reviewing the details of MNO Company and any known connections with a sanctioned person.
• The company examines the regulations for Country Y to determine which goods are prohibited for export.
  • This ensures that none of the thermal oxidizers being shipped are prohibited for export to that country.
  • JKL Canada also seeks information on the intended use and end destination of the thermal oxidizers.
• The company obtains independent legal advice on compliance requirements which confirms that the thermal oxidizers do not fall under the sanctions prohibitions for Country Y.
• The company maintains detailed records of all compliance measures, including screening processes, legal advice received, and communications with MNO Company.
  • This documentation serves as proof of their due diligence.
• The company establishes a monitoring process to ensure ongoing compliance. If any issues arise or new sanctions are imposed, the company is prepared to reassess the transaction and take necessary actions.

After conducting thorough screening, reviewing relevant material, consulting with legal advisors, and verifying the goods, the company confirms that MNO Company is not associated with any listed individuals or entities and that the thermal oxidizers are not prohibited exports for Country Y.

Case study #3: Providing services

FinancialX is a Canadian company specialising in IT solutions for the financial sector. The company must adhere to Canadian sanctions laws which prohibit the provision of sanctioned services. This includes prohibitions on providing technical advice, financial assistance, or other support in relation to sanctioned supplies, imports, or commercial activities.

FinancialX plans to offer IT consultancy services to FBank, a new client based in Country Z, which is subject to sanctions. FBank is seeking technical support for implementing and maintaining a new system for tracking interbank transfers. FinancialX needs to ensure that providing its services does not violate Canadian sanctions laws such as service prohibitions or any connections to any individual or entity on the Canadian Consolidated Autonomous Sanctions List or the UN Security Council Consolidated List.

FinancialX takes the following steps to avoid contravening sanctions:

• The company reviews Canada’s sanctions regulations for any relevant restrictions or prohibitions related to the country FBank operates in.
  • This includes checking for updates on sanctions regulations, prohibited services and reviewing the sanctions lists.

• The company explains its obligation to comply with Canada’s sanctions laws and requests detailed information from FBank, including its registration information, senior leadership and ownership structure.
  • FinancialX compares all FBank information against the sanctions lists and confirms that FBank is not a listed entity and that no indirect connections were found.
• FinancialX then examines the specific sanctions regulations for Country Z to understand which services are prohibited.
  • This helps determine if providing the requested IT consultancy services could be considered a sanctioned service under the current regulations.
  • The company considers the intended use of the software system and the nature of the services required.
• FinancialX is still uncertain if the services FBank is requesting are permitted under Canada’s sanctions laws and decides to consult independent legal advice.
• The company maintains detailed records of all compliance measures, including screening processes, legal advice received, and communications with FBank.
  • This documentation serves as proof of FinancialX’s due diligence.
• FinancialX sets up a monitoring process to ensure ongoing compliance.
  • If any issues arise or new sanctions are imposed, the company is prepared to reassess the provision of services and take necessary actions.

After conducting a thorough review, obtaining legal advice, and verifying the nature of the IT consultancy services, FinancialX confirms that providing services to FBank does not contravene sanctions regulations for Country Z.

Contact us

To contact Global Affairs Canada concerning sanctions, see Canadian sanctions - Contact us.

Additional resources, information and guidance

Consult Essential information for details on current sanctions measures, legislation, screening lists, permits and certificates, and other related resources. Thematic guidance and additional resources such as international resources are also available to support due diligence processes and sanctions compliance.